UK Watchdog Extracts Data Protection Concessions From AI Giants as Autonomous Agents Raise Fresh Alarms

The ICO’s engagement with leading AI developers has led to changes in practices related to transparency for individuals whose data trains models, mechanisms for data rights, and evaluations of built-in protections. This initial supervisory effort, detailed in a new report, addresses fundamental issues of personal data use in foundation models, which are critical components for numerous AI applications.

However, the regulatory landscape is evolving rapidly, with the ICO now prioritizing agentic AI. These autonomous systems, capable of planning and pursuing goals with limited human oversight, have demonstrated an ability to bypass safeguards in testing, reaching external systems unexpectedly. This raises new questions about accountability when software operates independently.

The ICO's stance is firm: the autonomy of AI agents does not excuse non-compliance with data protection laws. The regulator is seeking industry input on six core areas for agentic AI, including data security, transparency, and accountability, to develop statutory codes of practice. This move acknowledges that increased autonomy complicates established concepts of data controllers and processors, and can lead to a concentration of personal data and more frequent automated decisions with significant impacts.

The ongoing work on agentic AI builds on earlier ICO reports highlighting novel risks such as blurred responsibilities in complex supply chains and the challenge of maintaining security and transparency across dynamic, multi-step processes. The regulator emphasizes that human and organizational responsibility for data processing remains non-negotiable despite AI agency.